ClarityBeta

Science & Analytics

The Scientist

6 min read · 1,297 words · 3 moves to watch
The Signal

Only trajectory-encoded data moved Good Start Labs' 30B gains onto an outside benchmark.

Same model, same game, same content: single-turn state-to-move pairs raise the in-game score, and the gains stop inside the game. The trajectory arm bundles multi-turn structure, tools, planning, and adaptation into one condition, with no seeds and no effect sizes published, so the contribution of each part is unknown. That makes it a variable worth isolating in your own holdout before you rebuild a data pipeline around it.

In Play

  1. Training-Data Encoding Decided Transfer

    Good Start Labs trained one 30B model on the same board game two ways, per Latent.Space: single-turn state-to-move pairs, and a multi-turn agent that used tools, planned, and adapted. Both lifted the in-game score; only the trajectory design lifted an external Finance-Agent benchmark. If your post-training corpus is still prompt-and-gold-answer pairs, that is a testable reason your in-domain gains never reach production. No effect sizes, seeds, or ablations were published.

    Ask Clarity
    Try

  2. Counterfactual Arms Ship Into Agent Tooling

    Anthropic shipped a control arm into its coding agent: Claude Code can now run the same tasks with and without a plugin or skill and compare outcomes, per ben's bites. Techpresso reports a trading-agent evaluation that scores decision soundness and repeatability instead of returns, and found the top-scoring agent was not the top earner. Neither disclosed repeat counts or seeds, so single-pass comparisons will keep reporting sampling noise as lift.

    Ask Clarity
    Try

  3. Compute Rationing Reached the Point of Sale

    OpenAI stopped selling new $200-a-month Pro subscriptions for lack of compute, per Benedict Evans, and Computerworld reports the halt covers upgrades too. The Information reports personal-agent app Instinct is raising about $1B at a reported ~$10B valuation while still invite-gating past 100,000 users because of a compute crunch. Microsoft's plan takes AI-specific capacity from 2GW to roughly 12.7GW by 2032, about 36% a year in watts.

    Ask Clarity
    Try

  4. Stolen Keys Turn Endpoints Into Teachers

    CSO reports threat actors using stolen AI credentials and victim cloud accounts to run model-distillation attacks and AI-assisted exploitation pipelines. That makes your response schema and per-key rate limits security controls. A stolen internal key inherits loose internal limits and endpoints that still return full probability vectors. JavaScript Weekly separately reports live scanning of exposed Vite dev servers to read .env files. The threat claims carry no CVE IDs or query volumes.

    Ask Clarity

  5. Retention Terms Now Gate Model Choice

    Palantir and Booz Allen restricted Anthropic's Fable models and expanded onto OpenAI's Astra purely because zero data retention was obtainable from one and not the other, per Applied AI's reporting. Anthropic's June change stores Fable customer data for 30 days, justified as a security control. General zero-retention arrives via an unlaunched Enterprise Frontier Safeguards program with no published eligibility bar. Your model menu can now change without a model release.

    Ask Clarity
    Try

Deep Dives

Re-encode the Fine-Tune You Already Have

The cheapest capability upgrade available this quarter needs no new labels and no frontier budget, but it does need one non-isomorphic holdout to prove or kill it.

Four mechanisms, one bucket

Design B varies four things at once: multi-turn structure, tool access, explicit planning, and real-time adaptation. Latent.Space reports no effect sizes, no seeds, and no confidence intervals on the Finance-Agent result, and no ablation separating those four mechanisms. The evidence base for the broader claim is two self-reported internal demos — 1830 to finance, Diplomacy to customer support — with no independent replication. Treat the direction as strong and the magnitude as unknown.

The load-bearing caveat is structural similarity, and Duffy flags it himself. 1830 contains a stock-market mechanic; the transfer task was to query a database for how the game was played, load it into Excel, author functions, and compute an answer. Retrieve, transform, compute, justify — the same workflow topology as financial research with different nouns. He also cites Surge AI, where office-work post-training improved coding, and DeepSeek R1 for cross-domain reasoning transfer. Both cut against anything games-specific and toward general agentic post-training. The design rule that survives: pick proxy environments that match your production workflow's shape, not its vocabulary. Then hold back a non-isomorphic evaluation task before you believe a transfer number.

DimensionSingle-turn Q&AMulti-turn trajectories
Training signalState to next move, one shotTool calls, intermediate state, terminal reward
Off-task transferNone reportedImproved, magnitude undisclosed
Reward densityDense but shallow, per itemSparse terminal reward, needs shaping
Compute profileLow, batchableEpisode-bound plus critic inference
What it plausibly installsPolicy lookup over a fixed state spaceGoal-directed execution and tool use

The control arm exists in the tooling layer

ben's bites reports that Claude Code can run identical tasks with and without a plugin or skill and compare the outcomes. That is the instrument this ablation needs, shipped into the tooling layer rather than a separate offline job. But the announcement discloses no repeat count, no seed or temperature control, and no variance estimate. Agent outcomes are high-variance Bernoulli draws over stochastic decoding, flaky tools, and environment state, so a single-pass comparison will happily report a six-point "lift" that is pure sampling noise.

Techpresso sharpens the failure mode from the other side: a trading-agent evaluation scoring decision soundness and repeatability instead of returns found the top-scoring agent was not the top earner, and that agents frequently acted against their own stated analysis. Both sources agree on scoring the process rather than the draw. The second adds a constraint the first does not: the emitted rationale is not reliably upstream of the action. Your trajectory schema therefore has to join decision to outcome — never decision to narration.

What to log before you can't

Standard request/response logging discards exactly the credit-assignment link that makes a trajectory trainable. The minimum schema is observation, decision plus rationale, action or tool call, post-action state, and terminal label — versioned, with outcome labels retained. Counterfactuals cannot be backfilled: traffic you log today without the join is traffic you can never re-encode. One budget note — free GLM, DeepSeek and Kimi access through Bolt Forge runs until October 14. Eval budget is normally what caps your repeat count; until that date it does not.

Identical content, two encodings: one taught a policy lookup over a fixed state space, the other installed goal-directed execution — and only the second left the training distribution.

What to do

  1. Run a paired re-encoding ablation on one existing fine-tune within two weeks: same content as single-turn prompt/answer pairs versus multi-turn trajectories with tool calls and terminal reward, scored on in-domain accuracy and one out-of-domain agentic benchmark you did not train on.

  2. Extend agent trace logging this sprint to join decision to outcome — observation, decision, tool call, post-action state, terminal label — and version the schema before the next release.

  3. Book the free GLM, DeepSeek and Kimi window that closes October 14 for repeat runs at k>=5 per task per arm rather than demos.

Capacity Got Rationed. Your Cost Curve Is Quadratic.

Two facts belong in the same architecture review: a vendor is refusing its highest-paying buyers, and the largest slice of your token bill is one you re-bill on every single turn.

Per-watt accelerator gains plausibly add further improvement per generation, so effective compute growth outpaces growth in AI-dedicated power. The sources do not disclose the magnitudes.

What to do

  1. Instrument token amplification per session this sprint: log input, cached-read and output tokens plus static-prefix size by turn index, then fit the observed cumulative curve to find your real per-turn increment.

  2. Cut the static prefix within two weeks and test tiered tool loading against a fixed eval set, measuring realized cache-hit rate and time-to-first-token.

  3. Replay 500-1,000 logged tasks through a cheap-default-plus-frontier-fallback router before any vendor cost delta enters a business case, reporting cost per accepted output with bootstrapped confidence intervals and stratifying by task family.

Your Inference Endpoint Is Now Somebody's Teacher Model

Credential theft collapses both things that made model extraction expensive, and a live .env harvesting campaign is exactly how those credentials leave your GPU boxes.

Soft labels are the whole economics

Query-based extraction is throttled by two things: query budget and output verbosity. Argmax gives a student one label per query; a full probability vector gives it a dense target carrying far more information per call. The model-extraction literature puts functional clones of classifiers and fine-tuned LLMs in the 10⁴ to 10⁶ query range when endpoints return rich outputs. Internal endpoints almost always return the full distribution, top-k logits, or raw embeddings — because a downstream service asked for them two years ago and nobody revoked it. If your endpoint hands the distribution to any authenticated caller, you have pre-paid for the adversary's training run. That is a schema audit and a day of work, not a research project.

Calibration before anyone escalates: CSO's threat claims are single-sourced editorial framing with no CVE IDs, no named groups, and no query volumes. The specific claim that adversaries run their workloads inside victim cloud tenants is flagged as an inference rather than an observation. Prioritization signal, not evidence.

How the key leaves the building

JavaScript Weekly supplies the other half of the chain. Scanners are actively hunting exposed Vite dev servers and abusing a server.fs.deny bypass to read .env files. The flaw was patched in 7.3.2 and 8.0.5 earlier this year; the exploitation is happening now. On a front-end box that file leaks an analytics key. On yours it holds LLM API keys, the warehouse DSN, object-store credentials, and feature-store tokens, on a host with network reach into your data plane. ML environments are structurally over-exposed here, because remote GPU nodes, notebook servers, and internal dashboards get bound to 0.0.0.0 whenever port-forwarding becomes annoying. Patching closes the door; only rotation bounds the worst case.

ControlCost to implementUtility hitAttacker budget increaseFailure mode
Strip soft labels (top-1 plus bucketed confidence)DaysZero if no consumer reads the distributionLarge — dense targets become sparseBreaks internal consumers you never inventoried
Per-key query budgetsDays after the red-team curve existsNone for normal trafficDirect and linearAttacker spreads across many stolen keys
Per-credential prompt-distribution driftDays — reuses drift toolingNoneForces slower distribution-matched queryingAlert fatigue if not calibrated on replayed traces
Short-lived workload-federated credentialsDays to weeksNoneShrinks the exploitation windowHeadless-node ergonomics push engineers back to device code

Two detections you already own

The earliest observable signal of somebody else's training run on your endpoint is spend velocity, not a security alert — and monthly FinOps review is the wrong sampling rate. Use hourly CUSUM or Poisson-rate changepoint detection on tokens and GPU-hours keyed by service principal, on a robust baseline such as seasonal median plus MAD. Your own sweeps, backfills and eval reruns are the loudest legitimate source of anomalies. Make owner tags mandatory so unattributed spend fires rather than merely high spend, shadow-run for four weeks, and require alert precision above 0.5 before it pages anyone.

Second, both security items converge on the artifact ML teams hoard: the 3M and Watson Grinding litigation makes prompt and response traces discoverable business records. Your eval pipeline wants them forever and legal wants them gone, and those two identities have incompatible retention policies. Resolve it on your terms — raw traces on a 30-90 day TTL, plus a redacted, hashed, provenance-documented golden corpus with long retention and lineage that answers which fine-tuning partitions contain a held log. If a hold notice lands first, your regression baselines freeze with it.

Every extra probability your endpoint returns is free training signal for whoever holds the key — and the key is probably in a .env on a GPU box bound to 0.0.0.0.

What to do

  1. Sweep dev boxes, GPU nodes, notebook hosts and CI runners for dev servers bound off-loopback, enforce a Vite floor of 7.3.2 or 8.0.5 in CI, then rotate every credential that has ever lived in a .env on those hosts.

  2. Inventory which internal consumers read full probability vectors, logits or raw embeddings, then strip soft labels from externally reachable responses within two weeks, returning top-1 plus coarse-bucketed confidence.

  3. Run a self-directed distillation red-team this sprint: plot student-teacher agreement against query count with and without soft labels, and set per-key token budgets from the resulting curve.

The bottom line

These items rhyme in an uncomfortable way: every improvement that used to arrive for free — from the next model, the next price cut, the next capacity tier — is now rationed, repriced, or gated by a clause nobody on your team negotiated. What still compounds sits inside your own pipeline: how your training examples are shaped, whether a comparison carries a genuine second arm, and how many tokens you re-bill per turn. That retires roadmap planning that books quality wins against future releases. Prioritize producing two numbers you do not have: your out-of-domain delta and your per-session billed-token curve.